2023 CVEs (page 69)
Page 69 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48245 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP… |
CVE-2023-48244 | Medium | 5.3 | 2024-01-10 | The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request. |
CVE-2023-48243 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a cra… |
CVE-2023-48242 | Medium | 6.5 | 2024-01-10 | The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (… |
CVE-2023-51252 | Medium | 5.4 | 2024-01-10 | PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files and html files cont… |
CVE-2023-50120 | Medium | 5.5 | 2024-01-10 | MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c. This vuln… |
CVE-2023-49619 | Low | 3.1 | 2024-01-10 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer. This issue affects Apache Answer… |
CVE-2023-49471 | High | 8.8 | 2024-01-10 | Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before making a request t… |
CVE-2023-49427 | High | 7.5 | 2024-01-10 | Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList fu… |
CVE-2023-49394 | Medium | 6.1 | 2024-01-10 | Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly. |
CVE-2023-48864 | High | 7.5 | 2024-01-10 | SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php. |
CVE-2023-41603 | Medium | 5.3 | 2024-01-10 | D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers to arbitrarily access any services runnin… |
CVE-2023-41781 | Medium | 5.7 | 2024-01-10 | There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be trig… |
CVE-2023-31446 | Critical | 9.8 | 2024-01-10 | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to inject… |
CVE-2023-47997 | Medium | 6.5 | 2024-01-10 | An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to cause a denial of servi… |
CVE-2023-47996 | Medium | 6.5 | 2024-01-09 | An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a denial of service. |
CVE-2023-47995 | Medium | 6.5 | 2024-01-09 | Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to cause a denial of… |
CVE-2023-47994 | High | 8.8 | 2024-01-09 | An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a… |
CVE-2023-47993 | Medium | 6.5 | 2024-01-09 | A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service. |
CVE-2023-47992 | High | 8.8 | 2024-01-09 | An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, cause a denial-of-s… |
CVE-2023-3043 | Critical | 9.6 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploita… |
CVE-2023-37297 | High | 8.3 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this… |
CVE-2023-37296 | High | 8.3 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an adjacent network. A successful exploitation of th… |
CVE-2023-37295 | High | 8.3 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of t… |
CVE-2023-37294 | High | 8.3 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of… |
CVE-2023-37293 | Critical | 9.6 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of t… |
CVE-2023-34333 | High | 7.8 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful expl… |
CVE-2023-34332 | High | 7.8 | 2024-01-09 | AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successful explo… |
CVE-2023-6476 | Medium | 6.5 | 2024-01-09 | A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount… |
CVE-2023-5770 | Medium | 5.3 | 2024-01-09 | Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded HTML… |
CVE-2023-50136 | Medium | 5.4 | 2024-01-09 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new custom table. |
CVE-2023-38827 | Medium | 6.1 | 2024-01-09 | Cross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code via presentonesearc… |
CVE-2023-7032 | High | 7.8 | 2024-01-09 | A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges b… |
CVE-2023-6129 | Medium | 6.5 | 2024-01-09 | Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on Po… |
CVE-2023-7223 | Medium | 5.3 | 2024-01-09 | A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi… |
CVE-2023-7222 | High | 7.2 | 2024-01-09 | A vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452. It has been declared as critical. This vulnerability affects the function formTmultiAP of th… |
CVE-2023-7221 | Critical | 9.8 | 2024-01-09 | A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecg… |
CVE-2023-5376 | High | 8.6 | 2024-01-09 | An Improper Authentication vulnerability in Korenix JetNet TFTP allows abuse of this service. This issue affects JetNet devices older than firmware version 202… |
CVE-2023-5347 | Critical | 9.8 | 2024-01-09 | An Improper Verification of Cryptographic Signature vulnerability in the update process of Korenix JetNet Series allows replacing the whole operating system in… |
CVE-2023-51746 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V… |
CVE-2023-51745 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V… |
CVE-2023-51744 | Low | 3.3 | 2024-01-09 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V… |
CVE-2023-51439 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), Teamcenter Visualization V… |
CVE-2023-51438 | Critical | 10.0 | 2024-01-09 | A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions… |
CVE-2023-49722 | High | 8.3 | 2024-01-09 | Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi network. |
CVE-2023-49621 | Critical | 9.8 | 2024-01-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses def… |
CVE-2023-49252 | High | 7.5 | 2024-01-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change without authentication to… |
CVE-2023-49251 | High | 8.8 | 2024-01-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application allows a… |
CVE-2023-49132 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer acc… |
CVE-2023-49131 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer acc… |
CVE-2023-49130 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to uninitialized pointer acc… |
CVE-2023-49129 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain a stack overflow vulnerability wh… |
CVE-2023-49128 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application contains an out of bounds write past the e… |
CVE-2023-49127 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the en… |
CVE-2023-49126 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the en… |
CVE-2023-49124 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected applications contain an out of bounds read past the en… |
CVE-2023-49123 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflo… |
CVE-2023-49122 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflo… |
CVE-2023-49121 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10). The affected application is vulnerable to heap-based buffer overflo… |
CVE-2023-44120 | High | 7.8 | 2024-01-09 | A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product's sudo configuration permits the local administrative acco… |
CVE-2023-42797 | Medium | 6.6 | 2024-01-09 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V05.20). The network… |
CVE-2023-6149 | Medium | 5.7 | 2024-01-09 | Qualys Jenkins Plugin for WAS prior to version and including 2.0.11 was identified to be affected by a security flaw, which was missing a permission check whi… |
CVE-2023-6148 | Medium | 5.7 | 2024-01-09 | Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permissi… |
CVE-2023-50974 | Medium | 5.5 | 2024-01-09 | In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX… |
CVE-2023-50585 | Critical | 9.8 | 2024-01-09 | Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function. |
CVE-2023-49237 | Critical | 9.8 | 2024-01-09 | An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack lang… |
CVE-2023-49236 | Critical | 9.8 | 2024-01-09 | A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack… |
CVE-2023-49235 | Critical | 9.8 | 2024-01-09 | An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled during use of popen. Con… |
CVE-2023-7220 | Critical | 9.8 | 2024-01-09 | A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /c… |
CVE-2023-6147 | Medium | 5.7 | 2024-01-09 | Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permissi… |
CVE-2023-6842 | Medium | 4.4 | 2024-01-09 | The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scrip… |
CVE-2023-6830 | Medium | 6.5 | 2024-01-09 | The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated user… |
CVE-2023-50932 | High | 8.3 | 2024-01-09 | An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify ca… |
CVE-2023-50931 | High | 8.3 | 2024-01-09 | An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can… |
CVE-2023-50930 | High | 8.3 | 2024-01-09 | An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be m… |
CVE-2023-7219 | High | 7.2 | 2024-01-09 | A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of t… |
CVE-2023-6788 | Medium | 5.4 | 2024-01-09 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.1. This i… |
CVE-2023-6594 | Medium | 4.4 | 2024-01-09 | The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includin… |
CVE-2023-51717 | Critical | 9.8 | 2024-01-09 | Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass. |
CVE-2023-49238 | Critical | 9.8 | 2024-01-09 | In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-uni… |
CVE-2023-39336 | High | 8.8 | 2024-01-09 | An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to ex… |
CVE-2023-36629 | Medium | 5.5 | 2024-01-09 | The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read. |
CVE-2023-27098 | High | 7.5 | 2024-01-09 | TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel. |
CVE-2023-27000 | Medium | 6.1 | 2024-01-09 | Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name parameter of the Profile… |
CVE-2023-26999 | Critical | 9.8 | 2024-01-09 | An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted file. |
CVE-2023-26998 | Medium | 5.4 | 2024-01-09 | Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Aler… |
CVE-2023-50643 | Critical | 9.8 | 2024-01-09 | An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments compon… |
CVE-2023-46906 | Medium | 4.9 | 2024-01-09 | juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field wa… |
CVE-2023-50162 | High | 7.2 | 2024-01-09 | SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the DoExecSql function. |
CVE-2023-52074 | High | 8.8 | 2024-01-08 | FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig_updagte. |
CVE-2023-52073 | High | 8.8 | 2024-01-08 | FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config_footer_updagte. |
CVE-2023-52072 | High | 8.8 | 2024-01-08 | FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig_updagte. |
CVE-2023-7218 | High | 7.2 | 2024-01-08 | A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cs… |
CVE-2023-52202 | Critical | 9.1 | 2024-01-08 | Deserialization of Untrusted Data vulnerability in SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner Playlist Free.This issue affects HTML5 MP3 Player… |
CVE-2023-52201 | High | 7.6 | 2024-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brian D. Goad pTypeConverter.This issue affects pTypeConv… |
CVE-2023-52198 | Medium | 6.5 | 2024-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michiel van Eerd Private Google Calendars allows Stored X… |
CVE-2023-52197 | Medium | 5.9 | 2024-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Impactpixel Ads Invalid Click Protection allows Stored XS… |
CVE-2023-52196 | High | 7.1 | 2024-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phil Ewels CPT Bootstrap Carousel allows Reflected XSS.Th… |
CVE-2023-52142 | High | 7.6 | 2024-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cool Plugins Events Shortcodes For The Events Calendar.Th… |
CVE-2023-51508 | Medium | 5.3 | 2024-01-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database C… |